Jump to content

Can't remove malware & browser hijacked


Recommended Posts

Hello,

I purchased and installed the malwarebyte subscription, but the same malware keeps appearing every time I run a scan. My internet is also hijacked. I would run searches and the link would take me to another website. Thanks in advance for your help.

Below is the Malware log file.

Malwarebytes' Anti-Malware 1.51.0.1200

www.malwarebytes.org

Database version: 6866

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

6/16/2011 7:45:52 PM

mbam-log-2011-06-16 (19-45-52).txt

Scan type: Full scan (C:\|D:\|E:\|)

Objects scanned: 274387

Time elapsed: 50 minute(s), 54 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 8

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

c:\documents and settings\localservice\application data\02000000850cdedb1270c.manifest (Malware.Trace) -> Quarantined and deleted successfully.

c:\documents and settings\localservice\application data\02000000850cdedb1270o.manifest (Malware.Trace) -> Quarantined and deleted successfully.

c:\documents and settings\localservice\application data\02000000850cdedb1270p.manifest (Malware.Trace) -> Quarantined and deleted successfully.

c:\documents and settings\localservice\application data\02000000850cdedb1270s.manifest (Malware.Trace) -> Quarantined and deleted successfully.

c:\WINDOWS\system32\02000000850cdedb1270c.manifest (Malware.Trace) -> Quarantined and deleted successfully.

c:\WINDOWS\system32\02000000850cdedb1270o.manifest (Malware.Trace) -> Quarantined and deleted successfully.

c:\WINDOWS\system32\02000000850cdedb1270p.manifest (Malware.Trace) -> Quarantined and deleted successfully.

c:\WINDOWS\system32\02000000850cdedb1270s.manifest (Malware.Trace) -> Quarantined and deleted successfully.

DDS File:

.

DDS (Ver_2011-06-12.02) - NTFSx86

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_21

Run by Lily Phan at 19:59:05 on 2011-06-16

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.282 [GMT -7:00]

.

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

svchost.exe

svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe

C:\WINDOWS\system32\synceng32.exe

C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe

C:\WINDOWS\system32\TDispVol.exe

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\WINDOWS\ehome\ehtray.exe

C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\ltmoh\Ltmoh.exe

C:\WINDOWS\AGRSMMSG.exe

C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe

C:\Program Files\Toshiba\Tvs\TvsTray.exe

C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe

C:\WINDOWS\system32\DVDRAMSV.exe

C:\WINDOWS\system32\dla\DLACTRLW.exe

C:\WINDOWS\system32\hotplug32.exe

C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe

C:\WINDOWS\eHome\ehRecvr.exe

C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe

C:\Program Files\QuickTime\QTTask.exe

C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe

C:\Program Files\Synaptics\SynTP\Toshiba.exe

C:\WINDOWS\eHome\ehSched.exe

C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\TPSBattM.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe

C:\WINDOWS\system32\ctfmon.exe

C:\DOCUME~1\LILYPH~1\LOCALS~1\Temp\AutoDetect.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe

c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe

C:\WINDOWS\system32\RAMASST.exe

C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

C:\Program Files\Microsoft\BingBar\SeaPort.EXE

C:\WINDOWS\system32\SonyIEx.exe

svchost.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

c:\TOSHIBA\IVP\swupdate\swupdtmr.exe

C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe

C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

C:\WINDOWS\system32\dllhost.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\eHome\ehmsas.exe

C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\Program Files\Common Files\Java\Java Update\jucheck.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe

C:\WINDOWS\system32\msiexec.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = https://qbo.intuit.com/qbo28/login?redirect=true

uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7

mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyOverride = *.local

uURLSearchHooks: Swag Bucks Toolbar: {8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94} - c:\program files\swag_bucks\prxtbSwag.dll

BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll

BHO: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngine.dll

BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\DLASHX_W.DLL

BHO: Swag Bucks Toolbar: {8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94} - c:\program files\swag_bucks\prxtbSwag.dll

BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: ST: {9394ede7-c8b5-483e-8773-474bf36af6e4} - c:\program files\msn apps\st\01.03.0000.1005\en-xu\stmain.dll

BHO: 705e2fc6: {9caa4ca7-6bd5-1f9c-83ff-404cef23de9e} - c:\windows\system32\kbdru132.dll

BHO: {9D425283-D487-4337-BAB6-AB8354A81457} - No File

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar2.dll

BHO: MSNToolBandBHO: {bdbd1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\msn apps\msn toolbar\01.02.5000.1021\en-us\msntb.dll

BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "c:\program files\microsoft\bingbar\BingExt.dll"

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn\YTSingleInstance.dll

TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar2.dll

TB: {0BF43445-2F28-4351-9252-17FE6E806AA0} - No File

TB: MSN: {bdad1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\msn apps\msn toolbar\01.02.5000.1021\en-us\msntb.dll

TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll

TB: {9D425283-D487-4337-BAB6-AB8354A81457} - No File

TB: Swag Bucks Toolbar: {8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94} - c:\program files\swag_bucks\prxtbSwag.dll

TB: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngine.dll

TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "c:\program files\microsoft\bingbar\BingExt.dll"

TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File

uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background

uRun: [TOSCDSPD] c:\program files\toshiba\toscdspd\toscdspd.exe

uRun: [YSearchProtection] c:\program files\yahoo!\search protection\SearchProtection.exe

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [Ceedo AutoDetect] c:\docume~1\lilyph~1\locals~1\temp\AutoDetect.exe /active

uRunOnce: [Ceedo Repair] c:\docume~1\lilyph~1\locals~1\temp\AutoDetect.exe /repair /drive=

mRun: [TFncKy] TFncKy.exe

mRun: [TDispVol] TDispVol.exe

mRun: [igfxtray] c:\windows\system32\igfxtray.exe

mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe

mRun: [igfxpers] c:\windows\system32\igfxpers.exe

mRun: [ehTray] c:\windows\ehome\ehtray.exe

mRun: [THotkey] c:\program files\toshiba\toshiba applet\thotkey.exe

mRun: [synTPLpr] c:\program files\synaptics\syntp\SynTPLpr.exe

mRun: [synTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe

mRun: [LtMoh] c:\program files\ltmoh\Ltmoh.exe

mRun: [AGRSMMSG] AGRSMMSG.exe

mRun: [NDSTray.exe] NDSTray.exe

mRun: [Tvs] c:\program files\toshiba\tvs\TvsTray.exe

mRun: [TPSMain] TPSMain.exe

mRun: [smoothView] c:\program files\toshiba\toshiba zooming utility\SmoothView.exe

mRun: [dla] c:\windows\system32\dla\DLACTRLW.exe

mRun: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run

mRun: [intelZeroConfig] "c:\program files\intel\wireless\bin\ZCfgSvc.exe"

mRun: [intelWireless] "c:\program files\intel\wireless\bin\ifrmewrk.exe" /tf Intel PROSet/Wireless

mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

mRun: [ink Monitor] c:\program files\epson\ink monitor\InkMonitor.exe

mRun: [YSearchProtection] "c:\program files\yahoo!\search protection\SearchProtection.exe"

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [TkBellExe] "realsched.exe" -osboot

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\metama~1.lnk - c:\program files\metamail inc\metamail tray\Metamail Trust Manager.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\ramasst.lnk - c:\windows\system32\RAMASST.exe

IE: &Google Search - c:\program files\google\GoogleToolbar2.dll/cmsearch.html

IE: &Translate English Word - c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: Backward Links - c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html

IE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar2.dll/cmcache.html

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000

IE: Similar Pages - c:\program files\google\GoogleToolbar2.dll/cmsimilar.html

IE: Translate Page into English - c:\program files\google\GoogleToolbar2.dll/cmtrans.html

IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

Trusted Zone: amazon.com

Trusted Zone: google.com\www

Trusted Zone: phantasticphotography.com\www

Trusted Zone: yahoo.com\www

DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A}

DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/15107/CTPID.cab

TCP: DhcpNameServer = 192.168.1.1

TCP: Interfaces\{C018A622-B2C2-4B03-8CC9-98918AFDE84E} : DhcpNameServer = 192.168.1.1

TCP: Interfaces\{C7CAB0AA-82E2-4993-93EA-A69D3797F443} : NameServer = 203.162.0.181,203.162.4.190

Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL

Notify: igfxcui - igfxdev.dll

AppInit_DLLs: c:\windows\system32\kbdru132.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\documents and settings\lily phan\application data\mozilla\firefox\profiles\iyb8mqbn.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&SearchSource=3&q={searchTerms}

FF - prefs.js: browser.search.selectedEngine - Bing

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/firefox

FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&q=

FF - component: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\firefox\ext\components\nprpffbrowserrecordext.dll

FF - component: c:\documents and settings\lily phan\application data\mozilla\firefox\profiles\iyb8mqbn.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll

FF - component: c:\documents and settings\lily phan\application data\mozilla\firefox\profiles\iyb8mqbn.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar-ff3.dll

FF - component: c:\documents and settings\lily phan\application data\mozilla\firefox\profiles\iyb8mqbn.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\components\RadioWMPCoreGecko19.dll

FF - component: c:\documents and settings\lily phan\application data\mozilla\firefox\profiles\iyb8mqbn.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\components\RadioWMPCoreGecko19.dll

FF - component: c:\documents and settings\lily phan\application data\mozilla\firefox\profiles\iyb8mqbn.default\extensions\{e6103d7b-6052-4575-a010-59037765e87a}\components\RadioWMPCoreGecko19.dll

FF - component: c:\documents and settings\lily phan\application data\mozilla\firefox\profiles\iyb8mqbn.default\extensions\engine@conduit.com\components\RadioWMPCoreGecko19.dll

FF - plugin: c:\program files\google\picasa3\npPicasa3.dll

FF - plugin: c:\program files\google\update\1.3.21.57\npGoogleUpdate3.dll

FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files\microsoft silverlight\4.0.60310.0\npctrlui.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll

FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll

.

---- FIREFOX POLICIES ----

FF - user.js: yahoo.homepage.dontask - true

============= SERVICES / DRIVERS ===============

.

R2 COMSysApp32;COM+ System Application ;c:\windows\system32\synceng32.exe [2011-6-9 785920]

R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-6-14 366640]

R2 McAfee HackerWatch Service;McAfee HackerWatch Service;c:\program files\common files\mcafee\hackerwatch\HWAPI.exe [2006-8-17 540776]

R2 McProxy;McAfee Proxy Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2006-8-17 353368]

R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]

R2 SonyIEx;SonyIEx;c:\windows\system32\SonyIEx.exe [2007-8-4 126976]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-6-14 22712]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 gupdate1cabf40d51955e0;Google Update Service (gupdate1cabf40d51955e0);c:\program files\google\update\GoogleUpdate.exe [2010-3-8 133104]

S2 McRedirector;McAfee Redirector Service;c:\progra~1\common~1\mcafee\redirsvc\redirsvc.exe [2006-8-17 256096]

S2 Seagate Sync Service;Seagate Sync Service;"c:\program files\seagate\sync\seasyncservices.exe" --> c:\program files\seagate\sync\SeaSyncServices.exe [?]

S3 BBSvc;Bing Bar Update Service;c:\program files\microsoft\bingbar\BBSvc.EXE [2011-3-15 183560]

S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-3-8 133104]

S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2011-6-14 39984]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

.

=============== Created Last 30 ================

.

2011-06-17 02:46:18 359424 ----a-w- c:\windows\system32\atmpvcno32.dll

2011-06-15 03:59:10 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-06-15 03:59:06 22712 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-06-14 04:54:22 -------- d--h--w- c:\windows\system32\GroupPolicy

2011-06-14 04:06:47 222080 ------w- c:\windows\system32\MpSigStub.exe

2011-06-12 04:18:07 -------- d-----w- c:\documents and settings\lily phan\local settings\application data\Spoon

2011-06-11 05:39:01 -------- d-----w- c:\program files\Spybot - Search & Destroy

2011-06-11 05:39:01 -------- d-----w- c:\documents and settings\all users\application data\Spybot - Search & Destroy

2011-06-11 05:16:03 -------- d-----w- c:\program files\DVD Shrink

2011-06-11 03:39:54 0 ---ha-w- c:\documents and settings\lily phan\cpafbzsvhc.tmp

2011-06-10 04:45:05 785920 ----a-w- c:\windows\system32\hotplug32.exe

2011-06-10 04:45:05 168960 ----a-w- c:\windows\system32\kbdru132.dll

2011-06-10 04:45:03 785920 ----a-w- c:\windows\system32\synceng32.exe

2011-05-27 23:09:25 -------- d-----w- c:\documents and settings\lily phan\application data\Cheekie_Moonkie

2011-05-27 22:44:52 -------- d-----w- c:\program files\DDTool

2011-05-27 03:31:14 -------- d-----w- C:\THM

2011-05-27 03:28:40 -------- d-----w- c:\windows\XSxS

2011-05-27 03:28:40 -------- d-----w- c:\program files\Xenocode

2011-05-27 03:28:40 -------- d-----w- c:\program files\Winnydows

2011-05-27 03:28:40 -------- d-----w- c:\documents and settings\lily phan\local settings\application data\Xenocode

.

==================== Find3M ====================

.

2011-04-13 22:40:10 4284416 ----a-w- c:\windows\system32\GPhotos.scr

2011-04-10 23:49:32 0 ----a-w- c:\windows\system32\ConduitEngine.tmp

2011-03-22 03:38:18 73216 ----a-w- c:\windows\ST6UNST.EXE

2011-03-22 03:38:18 249856 -c----w- c:\windows\Setup1.exe

2011-02-26 21:08:30 39564 -c--a-w- c:\program files\RMPly00.exe

2009-03-14 01:00:56 6789864 -c--a-w- c:\program files\AmazonUnboxVideo.exe

2009-02-26 22:39:10 692379 -c--a-w- c:\program files\setupvni.exe

2007-04-25 16:00:52 1622912 -c--a-w- c:\program files\CuteWriter.exe

2006-05-03 19:06:54 163328 --sh--r- c:\windows\system32\flvDX.dll

2007-02-21 20:47:16 31232 --sh--r- c:\windows\system32\msfDX.dll

2008-03-16 22:30:52 216064 --sh--r- c:\windows\system32\nbDX.dll

.

============= FINISH: 20:00:07.75 ===============

Link to post
Share on other sites

  • Staff

Hi and welcome to Malwarebytes.

Please update MBAM, run a Quick Scan, and post its log.

Next, please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

  • When the tool is finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

-screen317

Link to post
Share on other sites

Thanks for getting back to me. As requested below are Malwarebyte quick scanlog, Combofix and DDS log.

Malwarebyte quick scan log:

Malwarebytes' Anti-Malware 1.51.0.1200

www.malwarebytes.org

Database version: 6897

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

6/19/2011 2:58:43 PM

mbam-log-2011-06-19 (14-58-43).txt

Scan type: Quick scan

Objects scanned: 169029

Time elapsed: 8 minute(s), 47 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 4

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

c:\WINDOWS\system32\02000000850cdedb1270c.manifest (Malware.Trace) -> Quarantined and deleted successfully.

c:\WINDOWS\system32\02000000850cdedb1270o.manifest (Malware.Trace) -> Quarantined and deleted successfully.

c:\WINDOWS\system32\02000000850cdedb1270p.manifest (Malware.Trace) -> Quarantined and deleted successfully.

c:\WINDOWS\system32\02000000850cdedb1270s.manifest (Malware.Trace) -> Quarantined and deleted successfully.

Combofix Log:

ComboFix 11-06-17.04 - Lily Phan 06/19/2011 15:11:51.1.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.570 [GMT -7:00]

Running from: c:\documents and settings\Lily Phan\My Documents\Downloads\ComboFix.exe

AV: avast! Internet Security *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}

FW: avast! Internet Security *Disabled* {7591DB91-41F0-48A3-B128-1A293FD8233D}

.

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\documents and settings\Administrator\WINDOWS

c:\documents and settings\All Users\Application Data\Tarma Installer

c:\documents and settings\Default User\WINDOWS

c:\documents and settings\Lily Phan\Application Data\Mozilla\Firefox\Profiles\iyb8mqbn.default\extensions\{42208f96-503b-46cf-8c45-7f9701c87863}

c:\documents and settings\Lily Phan\Application Data\Mozilla\Firefox\Profiles\iyb8mqbn.default\extensions\{42208f96-503b-46cf-8c45-7f9701c87863}\chrome.manifest

c:\documents and settings\Lily Phan\Application Data\Mozilla\Firefox\Profiles\iyb8mqbn.default\extensions\{42208f96-503b-46cf-8c45-7f9701c87863}\chrome\xulcache.jar

c:\documents and settings\Lily Phan\Application Data\Mozilla\Firefox\Profiles\iyb8mqbn.default\extensions\{42208f96-503b-46cf-8c45-7f9701c87863}\defaults\preferences\xulcache.js

c:\documents and settings\Lily Phan\Application Data\Mozilla\Firefox\Profiles\iyb8mqbn.default\extensions\{42208f96-503b-46cf-8c45-7f9701c87863}\install.rdf

c:\documents and settings\Lily Phan\Application Data\Mozilla\Firefox\Profiles\iyb8mqbn.default\extensions\{69a62691-03d4-4ca0-a19a-5b5db16bf3a3}

c:\documents and settings\Lily Phan\Application Data\Mozilla\Firefox\Profiles\iyb8mqbn.default\extensions\{69a62691-03d4-4ca0-a19a-5b5db16bf3a3}\chrome.manifest

c:\documents and settings\Lily Phan\Application Data\Mozilla\Firefox\Profiles\iyb8mqbn.default\extensions\{69a62691-03d4-4ca0-a19a-5b5db16bf3a3}\chrome\xulcache.jar

c:\documents and settings\Lily Phan\Application Data\Mozilla\Firefox\Profiles\iyb8mqbn.default\extensions\{69a62691-03d4-4ca0-a19a-5b5db16bf3a3}\defaults\preferences\xulcache.js

c:\documents and settings\Lily Phan\Application Data\Mozilla\Firefox\Profiles\iyb8mqbn.default\extensions\{69a62691-03d4-4ca0-a19a-5b5db16bf3a3}\install.rdf

c:\documents and settings\Lily Phan\Application Data\Mozilla\Firefox\Profiles\iyb8mqbn.default\extensions\{a6b1bd26-6285-4bd6-8b56-e9ba66b79908}

c:\documents and settings\Lily Phan\Application Data\Mozilla\Firefox\Profiles\iyb8mqbn.default\extensions\{a6b1bd26-6285-4bd6-8b56-e9ba66b79908}\chrome.manifest

c:\documents and settings\Lily Phan\Application Data\Mozilla\Firefox\Profiles\iyb8mqbn.default\extensions\{a6b1bd26-6285-4bd6-8b56-e9ba66b79908}\chrome\xulcache.jar

c:\documents and settings\Lily Phan\Application Data\Mozilla\Firefox\Profiles\iyb8mqbn.default\extensions\{a6b1bd26-6285-4bd6-8b56-e9ba66b79908}\defaults\preferences\xulcache.js

c:\documents and settings\Lily Phan\Application Data\Mozilla\Firefox\Profiles\iyb8mqbn.default\extensions\{a6b1bd26-6285-4bd6-8b56-e9ba66b79908}\install.rdf

c:\documents and settings\Lily Phan\Application Data\Mozilla\Firefox\Profiles\iyb8mqbn.default\extensions\{bdfd2fb7-419b-49d4-9fff-968810e14f81}

c:\documents and settings\Lily Phan\Application Data\Mozilla\Firefox\Profiles\iyb8mqbn.default\extensions\{bdfd2fb7-419b-49d4-9fff-968810e14f81}\chrome.manifest

c:\documents and settings\Lily Phan\Application Data\Mozilla\Firefox\Profiles\iyb8mqbn.default\extensions\{bdfd2fb7-419b-49d4-9fff-968810e14f81}\chrome\xulcache.jar

c:\documents and settings\Lily Phan\Application Data\Mozilla\Firefox\Profiles\iyb8mqbn.default\extensions\{bdfd2fb7-419b-49d4-9fff-968810e14f81}\defaults\preferences\xulcache.js

c:\documents and settings\Lily Phan\Application Data\Mozilla\Firefox\Profiles\iyb8mqbn.default\extensions\{bdfd2fb7-419b-49d4-9fff-968810e14f81}\install.rdf

c:\documents and settings\Lily Phan\Application Data\PriceGong

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\1.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\a.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\b.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\c.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\d.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\e.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\f.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\g.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\h.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\i.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\J.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\k.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\l.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\m.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\mru.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\n.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\o.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\p.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\q.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\r.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\s.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\t.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\u.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\v.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\w.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\x.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\y.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\z.xml

c:\documents and settings\Lily Phan\Templates\deow1vg58852bdtc3g62w37712kpxb620d03722ipd

c:\documents and settings\Lily Phan\WINDOWS

c:\webupdater\WebUpdater.exe

c:\windows\system32\config\systemprofile\WINDOWS

c:\windows\system32\drivers\cgxvpf.sys

c:\windows\system32\Thumbs.db

c:\windows\XSxS

.

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

-------\Service_ncua

.

.

((((((((((((((((((((((((( Files Created from 2011-05-19 to 2011-06-19 )))))))))))))))))))))))))))))))

.

.

2011-06-19 02:11 . 2011-05-10 11:59 19544 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys

2011-06-19 02:11 . 2011-05-10 12:03 307928 ----a-w- c:\windows\system32\drivers\aswSP.sys

2011-06-19 02:11 . 2011-05-10 12:04 102232 ----a-w- c:\windows\system32\drivers\aswFW.sys

2011-06-19 02:11 . 2011-05-10 12:03 192984 ----a-w- c:\windows\system32\drivers\aswNdis2.sys

2011-06-19 02:11 . 2011-05-10 11:59 25432 ----a-w- c:\windows\system32\drivers\aswRdr.sys

2011-06-19 02:11 . 2011-05-10 12:03 441176 ----a-w- c:\windows\system32\drivers\aswSnx.sys

2011-06-19 02:11 . 2011-05-10 12:02 49240 ----a-w- c:\windows\system32\drivers\aswTdi.sys

2011-06-19 02:11 . 2011-05-10 12:02 102616 ----a-w- c:\windows\system32\drivers\aswmon2.sys

2011-06-19 02:11 . 2011-05-10 12:02 96344 ----a-w- c:\windows\system32\drivers\aswmon.sys

2011-06-19 02:11 . 2011-05-10 11:59 30808 ----a-w- c:\windows\system32\drivers\aavmker4.sys

2011-06-19 02:10 . 2011-05-10 11:40 12112 ----a-w- c:\windows\system32\drivers\aswNdis.sys

2011-06-19 02:10 . 2011-05-10 12:10 40112 ----a-w- c:\windows\avastSS.scr

2011-06-19 02:10 . 2011-05-10 12:10 199304 ----a-w- c:\windows\system32\aswBoot.exe

2011-06-19 02:10 . 2011-06-19 02:10 -------- d-----w- c:\program files\AVAST Software

2011-06-19 02:10 . 2011-06-19 02:10 -------- d-----w- c:\documents and settings\All Users\Application Data\AVAST Software

2011-06-15 03:59 . 2011-05-29 16:11 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-06-15 03:59 . 2011-05-29 16:11 22712 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-06-15 02:38 . 2011-06-15 02:38 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla

2011-06-15 02:38 . 2011-06-15 02:38 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache

2011-06-14 04:54 . 2011-06-14 04:54 -------- d--h--w- c:\windows\system32\GroupPolicy

2011-06-14 04:06 . 2011-05-25 02:14 222080 ------w- c:\windows\system32\MpSigStub.exe

2011-06-12 04:18 . 2011-06-12 04:18 -------- d-----w- c:\documents and settings\Lily Phan\Local Settings\Application Data\Spoon

2011-06-11 05:39 . 2011-06-14 04:08 -------- d-----w- c:\program files\Spybot - Search & Destroy

2011-06-11 05:39 . 2011-06-14 04:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2011-06-11 05:16 . 2011-06-11 14:47 -------- d-----w- c:\program files\DVD Shrink

2011-06-11 03:39 . 2011-06-11 03:39 0 ---ha-w- c:\documents and settings\Lily Phan\cpafbzsvhc.tmp

2011-06-10 04:45 . 2011-06-10 04:45 168960 ----a-w- c:\windows\system32\kbdru132.dll

2011-06-10 04:45 . 2011-06-10 04:44 785920 ----a-w- c:\windows\system32\hotplug32.exe

2011-06-10 04:45 . 2011-06-10 04:44 785920 ----a-w- c:\windows\system32\synceng32.exe

2011-05-28 01:28 . 2011-06-11 18:32 -------- d-----w- c:\documents and settings\All Users\Application Data\DVD Shrink

2011-05-27 23:21 . 2011-05-28 02:53 -------- d-----w- c:\program files\Gabest

2011-05-27 23:09 . 2011-05-27 23:09 -------- d-----w- c:\documents and settings\Lily Phan\Application Data\Cheekie_Moonkie

2011-05-27 22:44 . 2011-05-27 23:16 -------- d-----w- c:\program files\DDTool

2011-05-27 03:31 . 2011-06-12 04:24 -------- d-----w- C:\THM

2011-05-27 03:28 . 2011-05-27 03:28 -------- d-----w- c:\program files\Xenocode

2011-05-27 03:28 . 2011-05-27 03:28 -------- d-----w- c:\program files\Winnydows

2011-05-27 03:28 . 2011-05-27 03:28 -------- d-----w- c:\documents and settings\Lily Phan\Local Settings\Application Data\Xenocode

.

.

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-04-13 22:40 . 2011-04-13 22:40 4284416 ----a-w- c:\windows\system32\GPhotos.scr

2011-04-10 23:49 . 2011-04-10 23:49 0 ----a-w- c:\windows\system32\ConduitEngine.tmp

2011-03-22 03:38 . 2011-03-22 03:38 249856 -c----w- c:\windows\Setup1.exe

2011-03-22 03:38 . 2011-03-22 03:38 73216 ----a-w- c:\windows\ST6UNST.EXE

2011-02-26 21:08 . 2011-01-20 04:01 39564 -c--a-w- c:\program files\RMPly00.exe

2009-03-14 01:00 . 2009-03-14 01:00 6789864 -c--a-w- c:\program files\AmazonUnboxVideo.exe

2009-02-26 22:39 . 2009-02-26 22:30 692379 -c--a-w- c:\program files\setupvni.exe

2007-04-25 16:00 . 2007-04-25 16:00 1622912 -c--a-w- c:\program files\CuteWriter.exe

2011-04-14 16:26 . 2011-04-30 06:07 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

2006-05-03 19:06 163328 --sh--r- c:\windows\system32\flvDX.dll

2007-02-21 20:47 31232 --sh--r- c:\windows\system32\msfDX.dll

2008-03-16 22:30 216064 --sh--r- c:\windows\system32\nbDX.dll

.

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}"= "c:\program files\Swag_Bucks\prxtbSwag.dll" [2011-01-17 175912]

.

[HKEY_CLASSES_ROOT\clsid\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}]

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]

2011-01-17 23:54 175912 ----a-w- c:\program files\ConduitEngine\prxConduitEngine.dll

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}]

2011-01-17 23:54 175912 ----a-w- c:\program files\Swag_Bucks\prxtbSwag.dll

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9CAA4CA7-6BD5-1F9C-83FF-404CEF23DE9E}]

2011-06-10 04:45 168960 ----a-w- c:\windows\system32\kbdru132.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}"= "c:\program files\Swag_Bucks\prxtbSwag.dll" [2011-01-17 175912]

"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\prxConduitEngine.dll" [2011-01-17 175912]

.

[HKEY_CLASSES_ROOT\clsid\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}]

.

[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{8BDEA9D6-6F62-45EB-8EE9-8A81AF0D2F94}"= "c:\program files\Swag_Bucks\prxtbSwag.dll" [2011-01-17 175912]

.

[HKEY_CLASSES_ROOT\clsid\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]

@="{472083B0-C522-11CF-8763-00608CC02F24}"

[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]

2011-05-10 12:10 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2004-12-30 65536]

"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"TkBellExe"="realsched.exe -osboot" [X]

"TFncKy"="TFncKy.exe" [bU]

"TDispVol"="TDispVol.exe" [2005-03-11 73728]

"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-11-28 98304]

"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-11-28 77824]

"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-11-28 118784]

"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]

"THotkey"="c:\program files\Toshiba\Toshiba Applet\thotkey.exe" [2006-01-05 352256]

"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2005-12-16 82009]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-12-16 761945]

"LtMoh"="c:\program files\ltmoh\Ltmoh.exe" [2004-08-18 184320]

"AGRSMMSG"="AGRSMMSG.exe" [2005-10-15 88203]

"NDSTray.exe"="NDSTray.exe" [bU]

"Tvs"="c:\program files\Toshiba\Tvs\TvsTray.exe" [2005-11-30 73728]

"TPSMain"="TPSMain.exe" [2005-06-01 282624]

"SmoothView"="c:\program files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe" [2005-04-27 122880]

"dla"="c:\windows\system32\dla\DLACTRLW.exe" [2005-10-06 122940]

"Pinger"="c:\toshiba\ivp\ism\pinger.exe" [2005-03-18 151552]

"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-12-05 667718]

"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-11-28 602182]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-08-10 421888]

"Ink Monitor"="c:\program files\EPSON\Ink Monitor\InkMonitor.exe" [2002-08-04 258116]

"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-01 421160]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-05-29 449584]

"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-05-10 3459712]

.

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-7-4 113664]

Metamail Trust Manager.lnk - c:\program files\Metamail Inc\Metamail Tray\Metamail Trust Manager.exe [2006-6-5 329472]

Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

RAMASST.lnk - c:\windows\system32\RAMASST.exe [2006-2-15 155648]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\windows\system32\kbdru132.dll

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\TOSHIBA\\ConfigFree\\CFXFER.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Macromedia\\Dreamweaver MX 2004\\Dreamweaver.exe"=

"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=

"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\WINDOWS\\system32\\synceng32.exe"=

.

R0 aswNdis;avast! Firewall NDIS Filter Service;c:\windows\system32\drivers\aswNdis.sys [6/18/2011 7:10 PM 12112]

R0 aswNdis2;avast! Firewall Core Firewall Service;c:\windows\system32\drivers\aswNdis2.sys [6/18/2011 7:11 PM 192984]

R1 aswFW;avast! TDI Firewall driver;c:\windows\system32\drivers\aswFW.sys [6/18/2011 7:11 PM 102232]

R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [6/18/2011 7:11 PM 441176]

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [6/18/2011 7:11 PM 307928]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [6/18/2011 7:11 PM 19544]

R2 COMSysApp32;COM+ System Application ;c:\windows\system32\synceng32.exe [6/9/2011 9:45 PM 785920]

R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [6/14/2011 8:59 PM 366640]

R2 SonyIEx;SonyIEx;c:\windows\system32\SonyIEx.exe [8/4/2007 7:59 PM 126976]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [6/14/2011 8:59 PM 22712]

S2 avast! Firewall;avast! Firewall;c:\program files\AVAST Software\Avast\afwServ.exe [6/18/2011 7:10 PM 121000]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 1:16 PM 130384]

S2 gupdate1cabf40d51955e0;Google Update Service (gupdate1cabf40d51955e0);c:\program files\Google\Update\GoogleUpdate.exe [3/8/2010 9:27 PM 133104]

S2 Seagate Sync Service;Seagate Sync Service;"c:\program files\Seagate\Sync\SeaSyncServices.exe" --> c:\program files\Seagate\Sync\SeaSyncServices.exe [?]

S3 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [3/15/2011 10:27 PM 183560]

S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [3/8/2010 9:27 PM 133104]

S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [6/14/2011 8:59 PM 39984]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 1:16 PM 753504]

.

--- Other Services/Drivers In Memory ---

.

*NewlyCreated* - WUAUSERV

.

Contents of the 'Scheduled Tasks' folder

.

2011-06-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-09 04:27]

.

2011-06-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-09 04:27]

.

2011-06-19 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1453406303-2187456597-1651317251-1005.job

- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 06:09]

.

2011-06-19 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1453406303-2187456597-1651317251-1005.job

- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 06:09]

.

.

------- Supplementary Scan -------

.

uStart Page = https://qbo.intuit.com/qbo28/login?redirect=true

uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7

mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyOverride = *.local

IE: &Google Search - c:\program files\google\GoogleToolbar2.dll/cmsearch.html

IE: &Translate English Word - c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: Backward Links - c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html

IE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar2.dll/cmcache.html

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000

IE: Similar Pages - c:\program files\google\GoogleToolbar2.dll/cmsimilar.html

IE: Translate Page into English - c:\program files\google\GoogleToolbar2.dll/cmtrans.html

Trusted Zone: amazon.com

Trusted Zone: google.com\www

Trusted Zone: phantasticphotography.com\www

Trusted Zone: yahoo.com\www

TCP: DhcpNameServer = 192.168.1.1

TCP: Interfaces\{C7CAB0AA-82E2-4993-93EA-A69D3797F443}: NameServer = 203.162.0.181,203.162.4.190

FF - ProfilePath - c:\documents and settings\Lily Phan\Application Data\Mozilla\Firefox\Profiles\iyb8mqbn.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&SearchSource=3&q={searchTerms}

FF - prefs.js: browser.search.selectedEngine - Bing

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/firefox

FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&q=

FF - user.js: yahoo.homepage.dontask - true

.

- - - - ORPHANS REMOVED - - - -

.

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-06-19 15:25

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'explorer.exe'(5056)

c:\windows\system32\WININET.dll

c:\windows\system32\TDispVol.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

c:\windows\system32\TPwrCfg.DLL

c:\windows\system32\TPwrReg.dll

c:\windows\system32\TPSTrace.DLL

.

------------------------ Other Running Processes ------------------------

.

c:\program files\Intel\Wireless\Bin\EvtEng.exe

c:\program files\Intel\Wireless\Bin\S24EvMon.exe

c:\program files\AVAST Software\Avast\AvastSvc.exe

c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe

c:\windows\system32\TDispVol.exe

c:\windows\system32\DVDRAMSV.exe

c:\windows\system32\hotplug32.exe

c:\windows\eHome\ehRecvr.exe

c:\windows\AGRSMMSG.exe

c:\program files\TOSHIBA\ConfigFree\NDSTray.exe

c:\windows\eHome\ehSched.exe

c:\program files\Common Files\EPSON\EBAPI\SAgent2.exe

c:\program files\Synaptics\SynTP\Toshiba.exe

c:\windows\system32\TPSBattM.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Common Files\McAfee\HackerWatch\HWAPI.exe

c:\progra~1\COMMON~1\mcafee\mcproxy\mcproxy.exe

c:\program files\Intel\Wireless\Bin\RegSrvc.exe

c:\program files\Microsoft\BingBar\SeaPort.EXE

c:\toshiba\IVP\swupdate\swupdtmr.exe

c:\program files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe

c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe

c:\windows\ehome\mcrdsvc.exe

c:\program files\iPod\bin\iPodService.exe

c:\windows\eHome\ehmsas.exe

c:\windows\system32\dllhost.exe

c:\progra~1\Intel\Wireless\Bin\Dot1XCfg.exe

c:\windows\system32\wscntfy.exe

c:\program files\Common Files\Java\Java Update\jucheck.exe

.

**************************************************************************

.

Completion time: 2011-06-19 15:32:40 - machine was rebooted

ComboFix-quarantined-files.txt 2011-06-19 22:32

.

Pre-Run: 91,039,035,392 bytes free

Post-Run: 91,000,008,704 bytes free

.

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /fastdetect /NoExecute=OptOut

.

- - End Of File - - EA62311CE4F90939A6A685C9D85BAE12

DDS Log:

.

DDS (Ver_2011-06-12.02) - NTFSx86

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_21

Run by Lily Phan at 15:38:13 on 2011-06-19

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.247 [GMT -7:00]

.

AV: avast! Internet Security *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}

FW: avast! Internet Security *Disabled*

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost.exe -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

svchost.exe

svchost.exe

C:\Program Files\AVAST Software\Avast\AvastSvc.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe

C:\WINDOWS\system32\synceng32.exe

C:\WINDOWS\system32\TDispVol.exe

C:\WINDOWS\system32\DVDRAMSV.exe

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hotplug32.exe

C:\WINDOWS\eHome\ehRecvr.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\WINDOWS\ehome\ehtray.exe

C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\ltmoh\Ltmoh.exe

C:\WINDOWS\AGRSMMSG.exe

C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe

C:\Program Files\Toshiba\Tvs\TvsTray.exe

C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe

C:\WINDOWS\system32\dla\DLACTRLW.exe

C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe

C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe

C:\Program Files\QuickTime\QTTask.exe

C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe

C:\WINDOWS\eHome\ehSched.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files\AVAST Software\Avast\avastUI.exe

C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe

C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe

C:\Program Files\Synaptics\SynTP\Toshiba.exe

C:\WINDOWS\system32\TPSBattM.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\WINDOWS\system32\RAMASST.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe

c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe

C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

C:\Program Files\Microsoft\BingBar\SeaPort.EXE

C:\WINDOWS\system32\SonyIEx.exe

svchost.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

c:\TOSHIBA\IVP\swupdate\swupdtmr.exe

C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe

C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\eHome\ehmsas.exe

C:\WINDOWS\system32\dllhost.exe

C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\Common Files\Java\Java Update\jucheck.exe

C:\WINDOWS\explorer.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = https://qbo.intuit.com/qbo28/login?redirect=true

uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7

mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyOverride = *.local

uURLSearchHooks: Swag Bucks Toolbar: {8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94} - c:\program files\swag_bucks\prxtbSwag.dll

BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll

BHO: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngine.dll

BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\DLASHX_W.DLL

BHO: Swag Bucks Toolbar: {8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94} - c:\program files\swag_bucks\prxtbSwag.dll

BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll

BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: ST: {9394ede7-c8b5-483e-8773-474bf36af6e4} - c:\program files\msn apps\st\01.03.0000.1005\en-xu\stmain.dll

BHO: 705e2fc6: {9caa4ca7-6bd5-1f9c-83ff-404cef23de9e} - c:\windows\system32\kbdru132.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar2.dll

BHO: MSNToolBandBHO: {bdbd1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\msn apps\msn toolbar\01.02.5000.1021\en-us\msntb.dll

BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "c:\program files\microsoft\bingbar\BingExt.dll"

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn\YTSingleInstance.dll

TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar2.dll

TB: {0BF43445-2F28-4351-9252-17FE6E806AA0} - No File

TB: MSN: {bdad1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\msn apps\msn toolbar\01.02.5000.1021\en-us\msntb.dll

TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll

TB: Swag Bucks Toolbar: {8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94} - c:\program files\swag_bucks\prxtbSwag.dll

TB: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngine.dll

TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "c:\program files\microsoft\bingbar\BingExt.dll"

TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll

uRun: [TOSCDSPD] c:\program files\toshiba\toscdspd\toscdspd.exe

uRun: [YSearchProtection] c:\program files\yahoo!\search protection\SearchProtection.exe

mRun: [TFncKy] TFncKy.exe

mRun: [TDispVol] TDispVol.exe

mRun: [igfxtray] c:\windows\system32\igfxtray.exe

mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe

mRun: [igfxpers] c:\windows\system32\igfxpers.exe

mRun: [ehTray] c:\windows\ehome\ehtray.exe

mRun: [THotkey] c:\program files\toshiba\toshiba applet\thotkey.exe

mRun: [synTPLpr] c:\program files\synaptics\syntp\SynTPLpr.exe

mRun: [synTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe

mRun: [LtMoh] c:\program files\ltmoh\Ltmoh.exe

mRun: [AGRSMMSG] AGRSMMSG.exe

mRun: [NDSTray.exe] NDSTray.exe

mRun: [Tvs] c:\program files\toshiba\tvs\TvsTray.exe

mRun: [TPSMain] TPSMain.exe

mRun: [smoothView] c:\program files\toshiba\toshiba zooming utility\SmoothView.exe

mRun: [dla] c:\windows\system32\dla\DLACTRLW.exe

mRun: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run

mRun: [intelZeroConfig] "c:\program files\intel\wireless\bin\ZCfgSvc.exe"

mRun: [intelWireless] "c:\program files\intel\wireless\bin\ifrmewrk.exe" /tf Intel PROSet/Wireless

mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

mRun: [ink Monitor] c:\program files\epson\ink monitor\InkMonitor.exe

mRun: [YSearchProtection] "c:\program files\yahoo!\search protection\SearchProtection.exe"

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [TkBellExe] "realsched.exe" -osboot

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray

mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\metama~1.lnk - c:\program files\metamail inc\metamail tray\Metamail Trust Manager.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\ramasst.lnk - c:\windows\system32\RAMASST.exe

IE: &Google Search - c:\program files\google\GoogleToolbar2.dll/cmsearch.html

IE: &Translate English Word - c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: Backward Links - c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html

IE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar2.dll/cmcache.html

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000

IE: Similar Pages - c:\program files\google\GoogleToolbar2.dll/cmsimilar.html

IE: Translate Page into English - c:\program files\google\GoogleToolbar2.dll/cmtrans.html

IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

Trusted Zone: amazon.com

Trusted Zone: google.com\www

Trusted Zone: phantasticphotography.com\www

Trusted Zone: yahoo.com\www

DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A}

DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/15107/CTPID.cab

TCP: DhcpNameServer = 192.168.1.1

TCP: Interfaces\{C018A622-B2C2-4B03-8CC9-98918AFDE84E} : DhcpNameServer = 192.168.1.1

TCP: Interfaces\{C7CAB0AA-82E2-4993-93EA-A69D3797F443} : NameServer = 203.162.0.181,203.162.4.190

Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL

Notify: igfxcui - igfxdev.dll

AppInit_DLLs: c:\windows\system32\kbdru132.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\documents and settings\lily phan\application data\mozilla\firefox\profiles\iyb8mqbn.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&SearchSource=3&q={searchTerms}

FF - prefs.js: browser.search.selectedEngine - Bing

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/firefox

FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&q=

FF - plugin: c:\program files\google\picasa3\npPicasa3.dll

FF - plugin: c:\program files\google\update\1.3.21.57\npGoogleUpdate3.dll

FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files\microsoft silverlight\4.0.60310.0\npctrlui.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll

FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll

.

---- FIREFOX POLICIES ----

FF - user.js: yahoo.homepage.dontask - true

.

============= SERVICES / DRIVERS ===============

.

R0 aswNdis;avast! Firewall NDIS Filter Service;c:\windows\system32\drivers\aswNdis.sys [2011-6-18 12112]

R0 aswNdis2;avast! Firewall Core Firewall Service;c:\windows\system32\drivers\aswNdis2.sys [2011-6-18 192984]

R1 aswFW;avast! TDI Firewall driver;c:\windows\system32\drivers\aswFW.sys [2011-6-18 102232]

R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2011-6-18 441176]

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2011-6-18 307928]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2011-6-18 19544]

R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2011-6-18 42184]

R2 COMSysApp32;COM+ System Application ;c:\windows\system32\synceng32.exe [2011-6-9 785920]

R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-6-14 366640]

R2 McAfee HackerWatch Service;McAfee HackerWatch Service;c:\program files\common files\mcafee\hackerwatch\HWAPI.exe [2006-8-17 540776]

R2 McProxy;McAfee Proxy Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2006-8-17 353368]

R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]

R2 SonyIEx;SonyIEx;c:\windows\system32\SonyIEx.exe [2007-8-4 126976]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-6-14 22712]

S2 avast! Firewall;avast! Firewall;c:\program files\avast software\avast\afwServ.exe [2011-6-18 121000]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 gupdate1cabf40d51955e0;Google Update Service (gupdate1cabf40d51955e0);c:\program files\google\update\GoogleUpdate.exe [2010-3-8 133104]

S2 McRedirector;McAfee Redirector Service;c:\progra~1\common~1\mcafee\redirsvc\redirsvc.exe [2006-8-17 256096]

S2 Seagate Sync Service;Seagate Sync Service;"c:\program files\seagate\sync\seasyncservices.exe" --> c:\program files\seagate\sync\SeaSyncServices.exe [?]

S3 BBSvc;Bing Bar Update Service;c:\program files\microsoft\bingbar\BBSvc.EXE [2011-3-15 183560]

S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-3-8 133104]

S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2011-6-14 39984]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

.

=============== Created Last 30 ================

.

2011-06-19 22:10:27 -------- d-sha-r- C:\cmdcons

2011-06-19 22:07:52 98816 ----a-w- c:\windows\sed.exe

2011-06-19 22:07:52 518144 ----a-w- c:\windows\SWREG.exe

2011-06-19 22:07:52 256512 ----a-w- c:\windows\PEV.exe

2011-06-19 22:07:52 208896 ----a-w- c:\windows\MBR.exe

2011-06-19 02:11:45 102232 ----a-w- c:\windows\system32\drivers\aswFW.sys

2011-06-19 02:11:11 192984 ----a-w- c:\windows\system32\drivers\aswNdis2.sys

2011-06-19 02:11:09 441176 ----a-w- c:\windows\system32\drivers\aswSnx.sys

2011-06-19 02:10:33 12112 ----a-w- c:\windows\system32\drivers\aswNdis.sys

2011-06-19 02:10:32 40112 ----a-w- c:\windows\avastSS.scr

2011-06-19 02:10:11 -------- d-----w- c:\program files\AVAST Software

2011-06-19 02:10:11 -------- d-----w- c:\documents and settings\all users\application data\AVAST Software

2011-06-15 03:59:10 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-06-15 03:59:06 22712 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-06-14 04:54:22 -------- d--h--w- c:\windows\system32\GroupPolicy

2011-06-14 04:06:47 222080 ------w- c:\windows\system32\MpSigStub.exe

2011-06-12 04:18:07 -------- d-----w- c:\documents and settings\lily phan\local settings\application data\Spoon

2011-06-11 05:39:01 -------- d-----w- c:\program files\Spybot - Search & Destroy

2011-06-11 05:39:01 -------- d-----w- c:\documents and settings\all users\application data\Spybot - Search & Destroy

2011-06-11 05:16:03 -------- d-----w- c:\program files\DVD Shrink

2011-06-11 03:39:54 0 ---ha-w- c:\documents and settings\lily phan\cpafbzsvhc.tmp

2011-06-10 04:45:05 785920 ----a-w- c:\windows\system32\hotplug32.exe

2011-06-10 04:45:05 168960 ----a-w- c:\windows\system32\kbdru132.dll

2011-06-10 04:45:03 785920 ----a-w- c:\windows\system32\synceng32.exe

2011-05-27 23:09:25 -------- d-----w- c:\documents and settings\lily phan\application data\Cheekie_Moonkie

2011-05-27 22:44:52 -------- d-----w- c:\program files\DDTool

2011-05-27 03:31:14 -------- d-----w- C:\THM

2011-05-27 03:28:40 -------- d-----w- c:\program files\Xenocode

2011-05-27 03:28:40 -------- d-----w- c:\program files\Winnydows

2011-05-27 03:28:40 -------- d-----w- c:\documents and settings\lily phan\local settings\application data\Xenocode

.

==================== Find3M ====================

.

2011-04-13 22:40:10 4284416 ----a-w- c:\windows\system32\GPhotos.scr

2011-04-10 23:49:32 0 ----a-w- c:\windows\system32\ConduitEngine.tmp

2011-03-22 03:38:18 73216 ----a-w- c:\windows\ST6UNST.EXE

2011-03-22 03:38:18 249856 -c----w- c:\windows\Setup1.exe

2011-02-26 21:08:30 39564 -c--a-w- c:\program files\RMPly00.exe

2009-03-14 01:00:56 6789864 -c--a-w- c:\program files\AmazonUnboxVideo.exe

2009-02-26 22:39:10 692379 -c--a-w- c:\program files\setupvni.exe

2007-04-25 16:00:52 1622912 -c--a-w- c:\program files\CuteWriter.exe

2006-05-03 19:06:54 163328 --sh--r- c:\windows\system32\flvDX.dll

2007-02-21 20:47:16 31232 --sh--r- c:\windows\system32\msfDX.dll

2008-03-16 22:30:52 216064 --sh--r- c:\windows\system32\nbDX.dll

.

============= FINISH: 15:39:14.79 ===============

Link to post
Share on other sites

Virus Total analysis is below and attached.

Antivirus Version Last Update Result

AhnLab-V3 2011.06.23.01 2011.06.23 -

AntiVir 7.11.10.75 2011.06.23 -

Antiy-AVL 2.0.3.7 2011.06.22 -

Avast 4.8.1351.0 2011.06.22 -

Avast5 5.0.677.0 2011.06.22 -

AVG 10.0.0.1190 2011.06.22 -

BitDefender 7.2 2011.06.23 Gen:Variant.Kazy.27226

CAT-QuickHeal 11.00 2011.06.22 -

ClamAV 0.97.0.0 2011.06.23 -

Commtouch 5.3.2.6 2011.06.23 -

Comodo 9159 2011.06.23 -

DrWeb 5.0.2.03300 2011.06.23 -

eSafe 7.0.17.0 2011.06.22 -

eTrust-Vet 36.1.8401 2011.06.22 Win32/SillyBHO.GWT

F-Prot 4.6.2.117 2011.06.22 -

F-Secure 9.0.16440.0 2011.06.23 Gen:Variant.Kazy.27226

Fortinet 4.2.257.0 2011.06.22 -

GData 22 2011.06.23 Gen:Variant.Kazy.27226

Ikarus T3.1.1.104.0 2011.06.23 -

Jiangmin 13.0.900 2011.06.22 -

K7AntiVirus 9.106.4834 2011.06.22 -

Kaspersky 9.0.0.837 2011.06.23 -

McAfee 5.400.0.1158 2011.06.23 Artemis!A82C18DC0142

McAfee-GW-Edition 2010.1D 2011.06.22 Artemis!A82C18DC0142

Microsoft 1.7000 2011.06.22 -

NOD32 6231 2011.06.23 -

Norman 6.07.10 2011.06.22 -

nProtect 2011-06-22.02 2011.06.22 Gen:Variant.Kazy.27226

Panda 10.0.3.5 2011.06.22 -

PCTools 8.0.0.5 2011.06.23 Trojan.Gen

Prevx 3.0 2011.06.23 -

Rising 23.63.02.03 2011.06.22 -

Sophos 4.66.0 2011.06.23 Troj/Bckdr-RHT

SUPERAntiSpyware 4.40.0.1006 2011.06.23 -

Symantec 20111.1.0.186 2011.06.23 Trojan.Gen.2

TheHacker 6.7.0.1.239 2011.06.23 -

TrendMicro 9.200.0.1012 2011.06.23 -

TrendMicro-HouseCall 9.200.0.1012 2011.06.23 -

VBA32 3.12.16.2 2011.06.22 -

VIPRE 9664 2011.06.23 -

ViRobot 2011.6.23.4528 2011.06.23 -

VirusBuster 14.0.91.1 2011.06.22 -

Additional information

MD5 : a82c18dc0142deeaf9fffc9c12d627f3

SHA1 : a7b2ba3c35b1e323b2e63fa4f52528318bdd7f61

SHA256: 04ec837c175ff6617ab01bfc2467e138378cc8f5544f216e024bc97300d63f11

ssdeep: 3072:ma6v/UxHib7CjBVYsb84pIKB/mY+rhWzpLcS9Fz01y/BCtPjhMb5:mvUB67CFBb8uIumhh

VS9FL/BEjh

File size : 168960 bytes

First seen: 2011-06-10 02:48:01

Last seen : 2011-06-23 03:46:17

TrID:

Win32 Executable MS Visual C++ (generic) (65.1%)

Win32 Executable Generic (14.7%)

Win32 Dynamic Link Library (generic) (13.1%)

Generic Win/DOS Executable (3.4%)

DOS Executable Generic (3.4%)

sigcheck:

publisher....: n/a

copyright....: Copyright © 2009

product......: Dr Link Library

description..: Dr Link Library

original name: Dr.DLL

internal name: Dr

file version.: 2009, 11, 12, 115

comments.....: n/a

signers......: -

signing date.: -

verified.....: Unsigned

PEInfo: PE structure information

[[ basic data ]]

entrypointaddress: 0x8C94

timedatestamp....: 0x43AE09BD (Sun Dec 25 02:53:49 2005)

machinetype......: 0x14c (I386)

[[ 8 section(s) ]]

name, viradd, virsiz, rawdsiz, ntropy, md5

.text, 0x1000, 0xA000, 0x9600, 5.82, 8b5a1f7b0cd58c6f361797dfdbc9c811

.data, 0xB000, 0xF000, 0xF000, 7.50, 346c1af89beefe2c3d936473abd5d880

.rdata, 0x1A000, 0xF000, 0xEE00, 7.47, d42962281eec260728fef0c8a5a211da

.bss, 0x29000, 0x4000, 0x0, 0.00, d41d8cd98f00b204e9800998ecf8427e

.edata, 0x2D000, 0x1000, 0x200, 4.05, 2c8484b20bf40a859b69083710f940e6

.idata, 0x2E000, 0x1000, 0x600, 4.78, e8338ef2d73ffe929d0f5fccbdb8a1c4

.rsrc, 0x2F000, 0x1000, 0x400, 2.59, bf731159fd6855cce424708e422fafb4

.reloc, 0x30000, 0xF71, 0x1000, 6.71, cd4934617a9c99a4e5bb9ee304f3a742

[[ 6 import(s) ]]

ADVAPI32.dll: OpenTraceW, RegDeleteKeyA, SetPrivateObjectSecurityEx, ChangeServiceConfig2W

KERNEL32.dll: DeleteFileA, DeviceIoControl, ExitProcess, GetModuleHandleA, GetProcAddress, HeapSize, LoadLibraryA, VirtualAlloc, VirtualFree

ole32.dll: StringFromGUID2, CLSIDFromString, CoBuildVersion, CoFileTimeNow, IsEqualGUID, CreateAntiMoniker

USER32.dll: RegisterHotKey, CharNextA, EnumDesktopsA, GetClassWord, GetClipboardFormatNameA, GetKBCodePage, GetPriorityClipboardFormat, IsCharAlphaA, IsClipboardFormatAvailable, MessageBoxExA, MessageBoxIndirectA, PeekMessageA, CloseWindowStation, SendMessageTimeoutW, SetClipboardViewer

security.dll: DeleteSecurityPackageW, FreeCredentialsHandle

MSVCRT.dll: exit, _cexit, __set_app_type, __p__commode, __getmainargs

[[ 9 export(s) ]]

CompressedFileReaderObjectCreate, CompressedFileReaderObjectUncompressedSizeGet, Create, DeviceAddLocal, DiscAtOnceRawPWFromFileAudioUnicode, FileCreate, ISO9660JolietFileTreeImportTrack, TestUnitReadyEx, TrackAtOnceFromMemory

ExifTool:

file metadata

CharacterSet: Unicode

CodeSize: 40960

EntryPoint: 0x8c94

FileDescription: Dr Link Library

FileFlagsMask: 0x0017

FileOS: Win32

FileSize: 165 kB

FileSubtype: 0

FileType: Win32 DLL

FileVersion: 2009, 11, 12, 115

FileVersionNumber: 2009.11.12.115

ImageVersion: 1.0

InitializedDataSize: 180224

InternalName: Dr

LanguageCode: Process default

LegalCopyright: Copyright © 2009

LinkerVersion: 2.38

MIMEType: application/octet-stream

MachineType: Intel 386 or later, and compatibles

OSVersion: 4.0

ObjectFileType: Dynamic link library

OriginalFilename: Dr.DLL

PEType: PE32

ProductName: Dr Link Library

ProductVersion: 1, 0, 0, 115

ProductVersionNumber: 1.0.0.115

Subsystem: Windows GUI

SubsystemVersion: 4.0

TimeStamp: 2005:12:25 03:53:49+01:00

UninitializedDataSize: 16384

VirusTotal.rar

Link to post
Share on other sites

  • Staff

No need to wait. We'll remove it now.

Please delete your copy of ComboFix, download the latest version from here, and save it to your Desktop. Do not run it yet.

Next, please open Notepad. Copy and paste the text in the Code box below into Notepad:

http://forums.malwarebytes.org/index.php?showtopic=87498
Collect::
c:\windows\system32\kbdru132.dll
DDS::
BHO: 705e2fc6: {9caa4ca7-6bd5-1f9c-83ff-404cef23de9e} - c:\windows\system32\kbdru132.dll

Save this as CFScript.txt

CFScriptB-4.gif

Refering to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you. Post that log in your next reply.

**Note**

When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.

  • Ensure you are connected to the internet and click OK on the message box.

Link to post
Share on other sites

It appears as though the kbdru132.dll file in question was added to MBAM recently because when I scanned my computer yesterday, this file was picked up and quarantined/deleted. I ran a full scan today and there was no malware. :)

But to be safe, I ran the combofix as you requested. However, I did not get a message box when the log appeared.

Combo log:

ComboFix 11-06-28.05 - Lily Phan 06/28/2011 20:36:42.2.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.423 [GMT -7:00]

Running from: c:\documents and settings\Lily Phan\My Documents\Downloads\ComboFix.exe

Command switches used :: c:\documents and settings\Lily Phan\My Documents\Downloads\CFScript.txt

AV: avast! Internet Security *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}

FW: avast! Internet Security *Disabled* {7591DB91-41F0-48A3-B128-1A293FD8233D}

.

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\windows\XSxS

.

.

((((((((((((((((((((((((( Files Created from 2011-05-28 to 2011-06-29 )))))))))))))))))))))))))))))))

.

.

2011-06-25 01:36 . 2011-06-25 01:36 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-06-19 02:11 . 2011-05-10 11:59 19544 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys

2011-06-19 02:11 . 2011-05-10 12:03 307928 ----a-w- c:\windows\system32\drivers\aswSP.sys

2011-06-19 02:11 . 2011-05-10 12:04 102232 ----a-w- c:\windows\system32\drivers\aswFW.sys

2011-06-19 02:11 . 2011-05-10 12:03 192984 ----a-w- c:\windows\system32\drivers\aswNdis2.sys

2011-06-19 02:11 . 2011-05-10 11:59 25432 ----a-w- c:\windows\system32\drivers\aswRdr.sys

2011-06-19 02:11 . 2011-05-10 12:03 441176 ----a-w- c:\windows\system32\drivers\aswSnx.sys

2011-06-19 02:11 . 2011-05-10 12:02 49240 ----a-w- c:\windows\system32\drivers\aswTdi.sys

2011-06-19 02:11 . 2011-05-10 12:02 102616 ----a-w- c:\windows\system32\drivers\aswmon2.sys

2011-06-19 02:11 . 2011-05-10 12:02 96344 ----a-w- c:\windows\system32\drivers\aswmon.sys

2011-06-19 02:11 . 2011-05-10 11:59 30808 ----a-w- c:\windows\system32\drivers\aavmker4.sys

2011-06-19 02:10 . 2011-05-10 11:40 12112 ----a-w- c:\windows\system32\drivers\aswNdis.sys

2011-06-19 02:10 . 2011-05-10 12:10 40112 ----a-w- c:\windows\avastSS.scr

2011-06-19 02:10 . 2011-05-10 12:10 199304 ----a-w- c:\windows\system32\aswBoot.exe

2011-06-19 02:10 . 2011-06-19 02:10 -------- d-----w- c:\program files\AVAST Software

2011-06-19 02:10 . 2011-06-19 02:10 -------- d-----w- c:\documents and settings\All Users\Application Data\AVAST Software

2011-06-15 03:59 . 2011-05-29 16:11 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-06-15 03:59 . 2011-05-29 16:11 22712 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-06-15 02:38 . 2011-06-15 02:38 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla

2011-06-15 02:38 . 2011-06-15 02:38 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache

2011-06-14 04:54 . 2011-06-14 04:54 -------- d--h--w- c:\windows\system32\GroupPolicy

2011-06-14 04:06 . 2011-05-25 02:14 222080 ------w- c:\windows\system32\MpSigStub.exe

2011-06-12 04:18 . 2011-06-12 04:18 -------- d-----w- c:\documents and settings\Lily Phan\Local Settings\Application Data\Spoon

2011-06-11 05:39 . 2011-06-14 04:08 -------- d-----w- c:\program files\Spybot - Search & Destroy

2011-06-11 05:39 . 2011-06-14 04:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2011-06-11 05:16 . 2011-06-11 14:47 -------- d-----w- c:\program files\DVD Shrink

2011-06-11 03:39 . 2011-06-11 03:39 0 ---ha-w- c:\documents and settings\Lily Phan\cpafbzsvhc.tmp

.

.

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-04-13 22:40 . 2011-04-13 22:40 4284416 ----a-w- c:\windows\system32\GPhotos.scr

2011-04-10 23:49 . 2011-04-10 23:49 0 ----a-w- c:\windows\system32\ConduitEngine.tmp

2011-02-26 21:08 . 2011-01-20 04:01 39564 -c--a-w- c:\program files\RMPly00.exe

2009-03-14 01:00 . 2009-03-14 01:00 6789864 -c--a-w- c:\program files\AmazonUnboxVideo.exe

2009-02-26 22:39 . 2009-02-26 22:30 692379 -c--a-w- c:\program files\setupvni.exe

2007-04-25 16:00 . 2007-04-25 16:00 1622912 -c--a-w- c:\program files\CuteWriter.exe

2011-04-14 16:26 . 2011-04-30 06:07 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

2006-05-03 19:06 163328 --sh--r- c:\windows\system32\flvDX.dll

2007-02-21 20:47 31232 --sh--r- c:\windows\system32\msfDX.dll

2008-03-16 22:30 216064 --sh--r- c:\windows\system32\nbDX.dll

.

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}"= "c:\program files\Swag_Bucks\prxtbSwag.dll" [2011-01-17 175912]

.

[HKEY_CLASSES_ROOT\clsid\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}]

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]

2011-01-17 23:54 175912 ----a-w- c:\program files\ConduitEngine\prxConduitEngine.dll

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}]

2011-01-17 23:54 175912 ----a-w- c:\program files\Swag_Bucks\prxtbSwag.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}"= "c:\program files\Swag_Bucks\prxtbSwag.dll" [2011-01-17 175912]

"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\prxConduitEngine.dll" [2011-01-17 175912]

.

[HKEY_CLASSES_ROOT\clsid\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}]

.

[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{8BDEA9D6-6F62-45EB-8EE9-8A81AF0D2F94}"= "c:\program files\Swag_Bucks\prxtbSwag.dll" [2011-01-17 175912]

.

[HKEY_CLASSES_ROOT\clsid\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]

@="{472083B0-C522-11CF-8763-00608CC02F24}"

[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]

2011-05-10 12:10 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2004-12-30 65536]

"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"TkBellExe"="realsched.exe -osboot" [X]

"TFncKy"="TFncKy.exe" [bU]

"TDispVol"="TDispVol.exe" [2005-03-11 73728]

"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-11-28 98304]

"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-11-28 77824]

"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-11-28 118784]

"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]

"THotkey"="c:\program files\Toshiba\Toshiba Applet\thotkey.exe" [2006-01-05 352256]

"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2005-12-16 82009]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-12-16 761945]

"LtMoh"="c:\program files\ltmoh\Ltmoh.exe" [2004-08-18 184320]

"AGRSMMSG"="AGRSMMSG.exe" [2005-10-15 88203]

"NDSTray.exe"="NDSTray.exe" [bU]

"Tvs"="c:\program files\Toshiba\Tvs\TvsTray.exe" [2005-11-30 73728]

"TPSMain"="TPSMain.exe" [2005-06-01 282624]

"SmoothView"="c:\program files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe" [2005-04-27 122880]

"dla"="c:\windows\system32\dla\DLACTRLW.exe" [2005-10-06 122940]

"Pinger"="c:\toshiba\ivp\ism\pinger.exe" [2005-03-18 151552]

"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-12-05 667718]

"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-11-28 602182]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-08-10 421888]

"Ink Monitor"="c:\program files\EPSON\Ink Monitor\InkMonitor.exe" [2002-08-04 258116]

"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-01 421160]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-05-29 449584]

"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-05-10 3459712]

.

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-7-4 113664]

Metamail Trust Manager.lnk - c:\program files\Metamail Inc\Metamail Tray\Metamail Trust Manager.exe [2006-6-5 329472]

Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

RAMASST.lnk - c:\windows\system32\RAMASST.exe [2006-2-15 155648]

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\TOSHIBA\\ConfigFree\\CFXFER.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Macromedia\\Dreamweaver MX 2004\\Dreamweaver.exe"=

"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=

"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

.

R0 aswNdis;avast! Firewall NDIS Filter Service;c:\windows\system32\drivers\aswNdis.sys [6/18/2011 7:10 PM 12112]

R0 aswNdis2;avast! Firewall Core Firewall Service;c:\windows\system32\drivers\aswNdis2.sys [6/18/2011 7:11 PM 192984]

R1 aswFW;avast! TDI Firewall driver;c:\windows\system32\drivers\aswFW.sys [6/18/2011 7:11 PM 102232]

R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [6/18/2011 7:11 PM 441176]

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [6/18/2011 7:11 PM 307928]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [6/18/2011 7:11 PM 19544]

R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [6/14/2011 8:59 PM 366640]

R2 SonyIEx;SonyIEx;c:\windows\system32\SonyIEx.exe [8/4/2007 7:59 PM 126976]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [6/14/2011 8:59 PM 22712]

S2 avast! Firewall;avast! Firewall;c:\program files\AVAST Software\Avast\afwServ.exe [6/18/2011 7:10 PM 121000]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 1:16 PM 130384]

S2 gupdate1cabf40d51955e0;Google Update Service (gupdate1cabf40d51955e0);c:\program files\Google\Update\GoogleUpdate.exe [3/8/2010 9:27 PM 133104]

S2 Seagate Sync Service;Seagate Sync Service;"c:\program files\Seagate\Sync\SeaSyncServices.exe" --> c:\program files\Seagate\Sync\SeaSyncServices.exe [?]

S3 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [3/15/2011 10:27 PM 183560]

S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [3/8/2010 9:27 PM 133104]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 1:16 PM 753504]

.

Contents of the 'Scheduled Tasks' folder

.

2011-06-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-09 04:27]

.

2011-06-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-09 04:27]

.

2011-06-29 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1453406303-2187456597-1651317251-1005.job

- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 06:09]

.

2011-06-25 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1453406303-2187456597-1651317251-1005.job

- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 06:09]

.

.

------- Supplementary Scan -------

.

uStart Page = https://qbo.intuit.com/qbo28/login?redirect=true

uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7

mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyOverride = *.local

IE: &Google Search - c:\program files\google\GoogleToolbar2.dll/cmsearch.html

IE: &Translate English Word - c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: Backward Links - c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html

IE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar2.dll/cmcache.html

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000

IE: Similar Pages - c:\program files\google\GoogleToolbar2.dll/cmsimilar.html

IE: Translate Page into English - c:\program files\google\GoogleToolbar2.dll/cmtrans.html

Trusted Zone: amazon.com

Trusted Zone: google.com\www

Trusted Zone: phantasticphotography.com\www

Trusted Zone: yahoo.com\www

TCP: DhcpNameServer = 192.168.1.1

TCP: Interfaces\{C7CAB0AA-82E2-4993-93EA-A69D3797F443}: NameServer = 203.162.0.181,203.162.4.190

FF - ProfilePath - c:\documents and settings\Lily Phan\Application Data\Mozilla\Firefox\Profiles\iyb8mqbn.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&SearchSource=3&q={searchTerms}

FF - prefs.js: browser.search.selectedEngine - Bing

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/firefox

FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&q=

FF - user.js: yahoo.homepage.dontask - true

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-06-28 20:53

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

.

C:\## aswSnx private storage

.

scan completed successfully

hidden files: 1

.

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'explorer.exe'(3052)

c:\windows\system32\WININET.dll

c:\windows\system32\TDispVol.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

c:\windows\system32\TPwrCfg.DLL

c:\windows\system32\TPwrReg.dll

c:\windows\system32\TPSTrace.DLL

.

------------------------ Other Running Processes ------------------------

.

c:\program files\Intel\Wireless\Bin\EvtEng.exe

c:\program files\Intel\Wireless\Bin\S24EvMon.exe

c:\program files\AVAST Software\Avast\AvastSvc.exe

c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe

c:\windows\system32\DVDRAMSV.exe

c:\windows\eHome\ehRecvr.exe

c:\windows\eHome\ehSched.exe

c:\program files\Common Files\EPSON\EBAPI\SAgent2.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Common Files\McAfee\HackerWatch\HWAPI.exe

c:\progra~1\COMMON~1\mcafee\mcproxy\mcproxy.exe

c:\program files\Intel\Wireless\Bin\RegSrvc.exe

c:\program files\Microsoft\BingBar\SeaPort.EXE

c:\windows\system32\TDispVol.exe

c:\toshiba\IVP\swupdate\swupdtmr.exe

c:\program files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe

c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe

c:\windows\AGRSMMSG.exe

c:\program files\TOSHIBA\ConfigFree\NDSTray.exe

c:\windows\ehome\mcrdsvc.exe

c:\program files\Synaptics\SynTP\Toshiba.exe

c:\windows\system32\TPSBattM.exe

c:\windows\system32\dllhost.exe

c:\windows\eHome\ehmsas.exe

c:\windows\system32\wscntfy.exe

c:\progra~1\Intel\Wireless\Bin\Dot1XCfg.exe

c:\progra~1\METAMA~1\METAMA~1\METAMA~2.EXE

c:\program files\iPod\bin\iPodService.exe

c:\program files\Common Files\Java\Java Update\jucheck.exe

.

**************************************************************************

.

Completion time: 2011-06-28 20:59:42 - machine was rebooted

ComboFix-quarantined-files.txt 2011-06-29 03:59

ComboFix2.txt 2011-06-19 22:32

.

Pre-Run: 92,031,320,064 bytes free

Post-Run: 92,037,586,944 bytes free

.

- - End Of File - - F5E5D89CB704730F01001B385660E6D3

ComboFix.txt

Link to post
Share on other sites

  • Staff

Great~!

Next, please run a free online scan with the ESET Online Scanner

Note: You will need to use Internet Explorer for this scan.

  1. Tick the box next to YES, I accept the Terms of Use.
  2. Click Start
  3. When asked, allow the ActiveX control to install
  4. Click Start
  5. Make sure that the options Remove found threats and the option Scan unwanted applications is checked
  6. Click Scan
    Wait for the scan to finish
  7. Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
  8. Copy and paste that log as a reply to this topic

Next, download my Security Check from here or here.

  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

Let me know how things are running now and what issues remain.

-screen317

Link to post
Share on other sites

  • 1 month later...
  • Staff

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.